<snip> > * Should any of the use cases be omitted? I don't think we should include a use case that simply consists of reporting the validation status of an X.509 certificate. SCVP is well underway and serves that purpose. That cert validity is reported as part of a data certification operation seems OK but establishing an alternative to SCVP is not in our scope.